# CVEs published 2019-04-09

169 CVEs were published on April 9, 2019: 1 critical, 9 high. 6 are now in CISA KEV. Days are UTC.

- [CVE-2019-11065](https://cve.now/CVE-2019-11065.md): Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plug (no CVSS, org.gradle:gradle-core)
- [CVE-2019-1573](https://cve.now/CVE-2019-1573.md): Information Disclosure in GlobalProtect Agent (CVSS 2.5, Palo Alto Networks GlobalProtect Agent)
- [CVE-2019-5585](https://cve.now/CVE-2019-5585.md): An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via mo (no CVSS, Fortinet FortiClientMac)
- [CVE-2018-1356](https://cve.now/CVE-2018-1356.md): A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code (no CVSS, Fortinet FortiSandbox)
- [CVE-2019-6140](https://cve.now/CVE-2019-6140.md): A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hyb (no CVSS, Forcepoint Email Security)
- [CVE-2019-8456](https://cve.now/CVE-2019-8456.md): Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration (no CVSS, Check Point IPsec VPN)
- [CVE-2019-3842](https://cve.now/CVE-2019-3842.md): In systemd before v242-rc4, it was discovered that pam\_systemd does not properly sanitize the environment before using the XDG\_SEAT variable (CVSS 4.5, The systemd Project systemd)
- [CVE-2019-9696](https://cve.now/CVE-2019-9696.md): Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can (no CVSS, Symantec VIP Enterprise Gateway)
- [CVE-2019-0869](https://cve.now/CVE-2019-0869.md): A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTM (no CVSS, Microsoft Azure DevOps Server)
- [CVE-2019-0870](https://cve.now/CVE-2019-0870.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0871](https://cve.now/CVE-2019-0871.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0874](https://cve.now/CVE-2019-0874.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps (no CVSS, Microsoft Azure DevOps Server)
- [CVE-2019-0875](https://cve.now/CVE-2019-0875.md): An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOp (no CVSS, Microsoft Azure DevOps Server)
- [CVE-2019-0876](https://cve.now/CVE-2019-0876.md): An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclav (no CVSS, Microsoft Open Enclave SDK)
- [CVE-2019-0877](https://cve.now/CVE-2019-0877.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0879](https://cve.now/CVE-2019-0879.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0853](https://cve.now/CVE-2019-0853.md): A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka (no CVSS, Microsoft Windows)
- [CVE-2019-0856](https://cve.now/CVE-2019-0856.md): A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerabi (no CVSS, Microsoft Windows)
- [CVE-2019-0857](https://cve.now/CVE-2019-0857.md): A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provi (no CVSS, Microsoft Azure DevOps Server)
- [CVE-2019-0858](https://cve.now/CVE-2019-0858.md): A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Micro (no CVSS, Microsoft Exchange Server)
- [CVE-2019-0859](https://cve.now/CVE-2019-0859.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-0860](https://cve.now/CVE-2019-0860.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0861](https://cve.now/CVE-2019-0861.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0862](https://cve.now/CVE-2019-0862.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0866](https://cve.now/CVE-2019-0866.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0867](https://cve.now/CVE-2019-0867.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0868](https://cve.now/CVE-2019-0868.md): A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-0839](https://cve.now/CVE-2019-0839.md): An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Wi (no CVSS, Microsoft Windows)
- [CVE-2019-0840](https://cve.now/CVE-2019-0840.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0841](https://cve.now/CVE-2019-0841.md): An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows El (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-0842](https://cve.now/CVE-2019-0842.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem (no CVSS, Microsoft Windows)
- [CVE-2019-0844](https://cve.now/CVE-2019-0844.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0845](https://cve.now/CVE-2019-0845.md): A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote C (no CVSS, Microsoft Windows)
- [CVE-2019-0846](https://cve.now/CVE-2019-0846.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0847](https://cve.now/CVE-2019-0847.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0848](https://cve.now/CVE-2019-0848.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-0849](https://cve.now/CVE-2019-0849.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0851](https://cve.now/CVE-2019-0851.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-0826](https://cve.now/CVE-2019-0826.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0827](https://cve.now/CVE-2019-0827.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0828](https://cve.now/CVE-2019-0828.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Excel · Microsoft Office)
- [CVE-2019-0829](https://cve.now/CVE-2019-0829.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0830](https://cve.now/CVE-2019-0830.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-0831](https://cve.now/CVE-2019-0831.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (CVSS 5.4, Microsoft SharePoint Server · Microsoft SharePoint Found… +1)
- [CVE-2019-0833](https://cve.now/CVE-2019-0833.md): An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Dis (no CVSS, Microsoft Edge)
- [CVE-2019-0835](https://cve.now/CVE-2019-0835.md): An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scriptin (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0836](https://cve.now/CVE-2019-0836.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation (no CVSS, Microsoft Windows)
- [CVE-2019-0837](https://cve.now/CVE-2019-0837.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulner (no CVSS, Microsoft Windows)
- [CVE-2019-0838](https://cve.now/CVE-2019-0838.md): An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, a (no CVSS, Microsoft Windows)
- [CVE-2019-0806](https://cve.now/CVE-2019-0806.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0810](https://cve.now/CVE-2019-0810.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0812](https://cve.now/CVE-2019-0812.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0813](https://cve.now/CVE-2019-0813.md): An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Wind (no CVSS, Microsoft Windows Admin Center)
- [CVE-2019-0814](https://cve.now/CVE-2019-0814.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0815](https://cve.now/CVE-2019-0815.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerabilit (no CVSS, Microsoft ASP.NET Core)
- [CVE-2019-0817](https://cve.now/CVE-2019-0817.md): A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Micro (no CVSS, Microsoft Exchange Server)
- [CVE-2019-0822](https://cve.now/CVE-2019-0822.md): A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics (no CVSS, Microsoft Office)
- [CVE-2019-0823](https://cve.now/CVE-2019-0823.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0824](https://cve.now/CVE-2019-0824.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0825](https://cve.now/CVE-2019-0825.md): A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2019-0791](https://cve.now/CVE-2019-0791.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0792](https://cve.now/CVE-2019-0792.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0793](https://cve.now/CVE-2019-0793.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0794](https://cve.now/CVE-2019-0794.md): A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execu (no CVSS, Microsoft Windows)
- [CVE-2019-0795](https://cve.now/CVE-2019-0795.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0796](https://cve.now/CVE-2019-0796.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation (no CVSS, Microsoft Windows)
- [CVE-2019-0801](https://cve.now/CVE-2019-0801.md): A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an a (no CVSS, Microsoft Office)
- [CVE-2019-0802](https://cve.now/CVE-2019-0802.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0803](https://cve.now/CVE-2019-0803.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-0805](https://cve.now/CVE-2019-0805.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation (no CVSS, Microsoft Windows)
- [CVE-2019-0790](https://cve.now/CVE-2019-0790.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0685](https://cve.now/CVE-2019-0685.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0688](https://cve.now/CVE-2019-0688.md): An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP I (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0730](https://cve.now/CVE-2019-0730.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation (no CVSS, Microsoft Windows)
- [CVE-2019-0731](https://cve.now/CVE-2019-0731.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation (no CVSS, Microsoft Windows)
- [CVE-2019-0732](https://cve.now/CVE-2019-0732.md): A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handl (no CVSS, Microsoft Windows)
- [CVE-2019-0735](https://cve.now/CVE-2019-0735.md): An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in (no CVSS, Microsoft Windows)
- [CVE-2019-0739](https://cve.now/CVE-2019-0739.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin (no CVSS, Microsoft Edge · Microsoft ChakraCore)
- [CVE-2019-0752](https://cve.now/CVE-2019-0752.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2019-0753](https://cve.now/CVE-2019-0753.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0764](https://cve.now/CVE-2019-0764.md): A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers T (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2019-0786](https://cve.now/CVE-2019-0786.md): An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials at (no CVSS, Microsoft Windows)
- [CVE-2019-5513](https://cve.now/CVE-2019-5513.md): VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability. (no CVSS, VMware Horizon Connection Server)
- [CVE-2019-5512](https://cve.now/CVE-2019-5512.md): VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately. (no CVSS, VMware Workstation)
- [CVE-2019-5511](https://cve.now/CVE-2019-5511.md): VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately. (no CVSS, VMware Workstation)
- [CVE-2019-7359](https://cve.now/CVE-2019-7359.md): An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk (no CVSS, Autodesk Advance Steel · Autodesk AutoCAD +1)
- [CVE-2019-7358](https://cve.now/CVE-2019-7358.md): An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk (no CVSS, Autodesk AutoCAD LT · Autodesk Civil +2)
- [CVE-2019-7361](https://cve.now/CVE-2019-7361.md): An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution (no CVSS, Autodesk Civil · Autodesk Advance Steel +1)
- [CVE-2019-7360](https://cve.now/CVE-2019-7360.md): An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk (no CVSS, Autodesk Civil · Autodesk Advance Steel +1)
- [CVE-2019-1567](https://cve.now/CVE-2019-1567.md): The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping (no CVSS, Palo Alto Networks Expedition Migration Tool)
- [CVE-2018-18365](https://cve.now/CVE-2018-18365.md): Norton Password Manager may be susceptible to an address spoofing issue. (no CVSS, Norton Password Manager)
- [CVE-2018-16530](https://cve.now/CVE-2018-16530.md): A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a p (no CVSS, Forcepoint Email Security)
- [CVE-2018-7117](https://cve.now/CVE-2018-7117.md): A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 (no CVSS, HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers)
- [CVE-2018-7118](https://cve.now/CVE-2018-7118.md): A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version (no CVSS, HPE Service Pack for Proliant)
- [CVE-2019-7174](https://cve.now/CVE-2019-7174.md): Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Ec (no CVSS)
- [CVE-2019-9134](https://cve.now/CVE-2019-9134.md): Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary c (CVSS 7.4, Solideo Systems Co Architectural Information System)
- [CVE-2019-6117](https://cve.now/CVE-2019-6117.md): The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function. (no CVSS)
- [CVE-2018-19586](https://cve.now/CVE-2018-19586.md): Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads be (no CVSS)
- [CVE-2019-8990](https://cve.now/CVE-2019-8990.md): TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication (CVSS 9.1, TIBCO Software TIBCO ActiveMatrix BusinessWorks)
- [CVE-2019-9133](https://cve.now/CVE-2019-9133.md): KMPlayer Subtitles parser Heap Overflow Vulnerability (CVSS 7.8, Pandora.tv KMPlayer)
- [CVE-2018-14894](https://cve.now/CVE-2018-14894.md): CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended (no CVSS)
- [CVE-2017-17023](https://cve.now/CVE-2017-17023.md): The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). (no CVSS)
- [CVE-2017-3139](https://cve.now/CVE-2017-3139.md): A denial of service flaw was found in the way BIND handled DNSSEC validation. (no CVSS, Red Hat BIND)
- [CVE-2018-20698](https://cve.now/CVE-2018-20698.md): The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set. (no CVSS)
- [CVE-2018-19589](https://cve.now/CVE-2018-19589.md): Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows (no CVSS)
- [CVE-2018-13366](https://cve.now/CVE-2018-13366.md): An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via (no CVSS, Fortinet FortiOS)
- [CVE-2019-10242](https://cve.now/CVE-2019-10242.md): In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path travers (no CVSS, The Eclipse Foundation Eclipse Kura)
- [CVE-2019-10243](https://cve.now/CVE-2019-10243.md): In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. (no CVSS, The Eclipse Foundation Eclipse Kura)
- [CVE-2019-10244](https://cve.now/CVE-2019-10244.md): In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position (no CVSS, The Eclipse Foundation Eclipse Kura)
- [CVE-2018-15640](https://cve.now/CVE-2018-15640.md): Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated pr (CVSS 8.1, Odoo Enterprise)
- [CVE-2018-15631](https://cve.now/CVE-2018-15631.md): Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authentica (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2018-15635](https://cve.now/CVE-2018-15635.md): Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote (CVSS 5.9, Odoo Community · Odoo Enterprise)
- [CVE-2017-17544](https://cve.now/CVE-2017-17544.md): A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their (no CVSS, Fortinet FortiOS)
- [CVE-2019-3795](https://cve.now/CVE-2019-3795.md): Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security (CVSS 3.8, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2019-5615](https://cve.now/CVE-2019-5615.md): Rapid7 InsightVM Stored Credential Exposure (CVSS 3.1, Rapid7 InsightVM)
- [CVE-2019-3880](https://cve.now/CVE-2019-3880.md): A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. (CVSS 4.2, The Samba Project samba)
- [CVE-2019-3870](https://cve.now/CVE-2019-3870.md): A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. (CVSS 6.1, The Samba Project samba)
- [CVE-2019-3893](https://cve.now/CVE-2019-3893.md): In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the (CVSS 4.9, The Foreman Project foreman)
- [CVE-2019-3941](https://cve.now/CVE-2019-3941.md): Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. (no CVSS, Advantech WebAccess)
- [CVE-2019-3940](https://cve.now/CVE-2019-3940.md): Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. (no CVSS, Advantech WebAccess)
- [CVE-2019-11028](https://cve.now/CVE-2019-11028.md): GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the (no CVSS)
- [CVE-2019-10634](https://cve.now/CVE-2019-10634.md): An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HT (no CVSS)
- [CVE-2019-10633](https://cve.now/CVE-2019-10633.md): An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated a (no CVSS)
- [CVE-2019-10632](https://cve.now/CVE-2019-10632.md): A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user (no CVSS)
- [CVE-2019-10631](https://cve.now/CVE-2019-10631.md): Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute a (no CVSS)
- [CVE-2019-10630](https://cve.now/CVE-2019-10630.md): A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the dev (no CVSS)
- [CVE-2019-10903](https://cve.now/CVE-2019-10903.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. (no CVSS)
- [CVE-2019-10902](https://cve.now/CVE-2019-10902.md): In Wireshark 3.0.0, the TSDNS dissector could crash. (no CVSS)
- [CVE-2019-10901](https://cve.now/CVE-2019-10901.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. (no CVSS)
- [CVE-2019-10900](https://cve.now/CVE-2019-10900.md): In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. (no CVSS)
- [CVE-2019-10899](https://cve.now/CVE-2019-10899.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. (no CVSS)
- [CVE-2019-10898](https://cve.now/CVE-2019-10898.md): In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. (no CVSS)
- [CVE-2019-10897](https://cve.now/CVE-2019-10897.md): In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. (no CVSS)
- [CVE-2019-10896](https://cve.now/CVE-2019-10896.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. (no CVSS)
- [CVE-2019-10895](https://cve.now/CVE-2019-10895.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. (no CVSS)
- [CVE-2019-10894](https://cve.now/CVE-2019-10894.md): In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. (no CVSS)
- [CVE-2019-0782](https://cve.now/CVE-2019-0782.md): An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In (no CVSS, Microsoft Windows)
- [CVE-2019-0783](https://cve.now/CVE-2019-0783.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0784](https://cve.now/CVE-2019-0784.md): A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, aka 'Windows ActiveX (no CVSS, Microsoft Windows)
- [CVE-2019-0797](https://cve.now/CVE-2019-0797.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0798](https://cve.now/CVE-2019-0798.md): A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka (no CVSS, Microsoft Skype for Business Server · Microsoft Lync Server)
- [CVE-2019-0804](https://cve.now/CVE-2019-0804.md): An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent In (no CVSS, Microsoft Azure)
- [CVE-2019-0808](https://cve.now/CVE-2019-0808.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-0809](https://cve.now/CVE-2019-0809.md): A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading (no CVSS, Microsoft Visual Studio)
- [CVE-2019-0816](https://cve.now/CVE-2019-0816.md): A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images that use cloud-init, (no CVSS, Microsoft Ubuntu Server)
- [CVE-2019-0821](https://cve.now/CVE-2019-0821.md): An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information (no CVSS, Microsoft Windows)
- [CVE-2019-0770](https://cve.now/CVE-2019-0770.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin (no CVSS, Microsoft Edge)
- [CVE-2019-0771](https://cve.now/CVE-2019-0771.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0772](https://cve.now/CVE-2019-0772.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Rem (no CVSS, Microsoft Windows)
- [CVE-2019-0773](https://cve.now/CVE-2019-0773.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-0774](https://cve.now/CVE-2019-0774.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-0775](https://cve.now/CVE-2019-0775.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-0776](https://cve.now/CVE-2019-0776.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-0777](https://cve.now/CVE-2019-0777.md): A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun (no CVSS, Microsoft Team Foundation Server)
- [CVE-2019-0778](https://cve.now/CVE-2019-0778.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-0779](https://cve.now/CVE-2019-0779.md): A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruptio (no CVSS, Microsoft Edge)
- [CVE-2019-0780](https://cve.now/CVE-2019-0780.md): A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corr (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2019-0756](https://cve.now/CVE-2019-0756.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-0757](https://cve.now/CVE-2019-0757.md): A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify a NuGet (no CVSS, Microsoft Visual Studio · Microsoft .NET Core SDK +2)
- [CVE-2019-0759](https://cve.now/CVE-2019-0759.md): An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory, aka 'Windows Print (no CVSS, Microsoft Windows)
- [CVE-2019-0761](https://cve.now/CVE-2019-0761.md): A security feature bypass vulnerability exists when Internet Explorer fails to validate the correct Security Zone of requests for specific U (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0762](https://cve.now/CVE-2019-0762.md): A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Brows (no CVSS, Microsoft Internet Explorer · Microsoft Edge)
- [CVE-2019-0763](https://cve.now/CVE-2019-0763.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0765](https://cve.now/CVE-2019-0765.md): A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory, aka 'Comctl32 Remote Code Execution Vul (no CVSS, Microsoft Windows)
- [CVE-2019-0766](https://cve.now/CVE-2019-0766.md): An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0767](https://cve.now/CVE-2019-0767.md): An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerabilit (no CVSS, Microsoft Windows)
- [CVE-2019-0768](https://cve.now/CVE-2019-0768.md): A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under sp (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-0769](https://cve.now/CVE-2019-0769.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scriptin (no CVSS, Microsoft Edge · Microsoft ChakraCore +1)
- [CVE-2019-3887](https://cve.now/CVE-2019-3887.md): A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. (CVSS 6.7, The Linux Foundation Kernel)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.